redirect to login if no user exists